Professional Documents
Culture Documents
Web Application Penetration Testing Course Content
Web Application Penetration Testing Course Content
www.infosectrain.com | [email protected] 01
Target Audience
Web Application Penetration Testing Course is beneficial for:
• Penetration testers
• Application developers
• Web administrators
• Security analysts
Pre-Requisite
• Basic understanding of HTML, HTTP and JavaScript.
• Knowledge of PHP code will help although it is not mandatory
• one year in an information security role, or equivalent experience
is recommended.
www.infosectrain.com | [email protected] 02
Why Infosec Train?
www.infosectrain.com | [email protected] 03
COURSE CONTENT
Authentication vulnerabilities
Authorization vulnerabilities
Information leak
www.infosectrain.com | [email protected] 04
Course Content
Authentication vulnerabilities
• Authentication scenarios
• User enumeration
• Guessing passwords - Brute force & Dictionary attacks
• Default users/passwords
• Weak password policy
• Direct page requests
• Parameter modification
• Password flaws
• Locking out users
• Lack of SSL at login pages
• Bypassing weak CAPTCHA mechanisms
• Login without SSL
Authorization vulnerabilities
• Role-based access control (RBAC)
• Authorization bypassing
• Forceful browsing
• Client-side validation attacks
• Insecure direct object reference
www.infosectrain.com | [email protected] 05
Improper Input Validation & Injection vulnerabilities
www.infosectrain.com | [email protected] 06
Information leak
www.infosectrain.com | [email protected] 07
www.infosectrain.com | [email protected]